{"id":112,"date":"2021-12-10T12:00:14","date_gmt":"2021-12-10T10:00:14","guid":{"rendered":"https:\/\/ackeeblockchain.com\/blog\/?p=112"},"modified":"2022-07-31T13:45:39","modified_gmt":"2022-07-31T11:45:39","slug":"ackee-blockchain-audited-debridge-finance","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/ackee-blockchain-audited-debridge-finance\/","title":{"rendered":"Ackee Blockchain audited deBridge Finance"},"content":{"rendered":"<h4>About deBridge Finance<\/h4>\n<p><a href=\"https:\/\/debridge.finance\/\">deBridge<\/a><b><\/b> is <strong>a cross-chain interoperability and liquidity transfer protocol<\/strong> that allows decentralized transfer of assets between various blockchains. The cross-chain intercommunication of deBridge smart contracts is powered by a network of independent oracles\/validators elected by deBridge governance.<!--more--><\/p>\n<p>deBridge protocol is an infrastructure platform and hooking service which <strong>aims to become a standard for<\/strong>:<\/p>\n<ul class=\"\">\n<li id=\"2c5b\" class=\"mj mk iv kf b kg kh kk kl ko ml ks mm kw mn la mo mp mq mr fx\" data-selectable-paragraph=\"\">Cross-chain composability of smart contracts<\/li>\n<li id=\"d7e9\" class=\"mj mk iv kf b kg ms kk mt ko mu ks mv kw mw la mo mp mq mr fx\" data-selectable-paragraph=\"\">Cross-chain swaps<\/li>\n<li id=\"159a\" class=\"mj mk iv kf b kg ms kk mt ko mu ks mv kw mw la mo mp mq mr fx\" data-selectable-paragraph=\"\">Bridging of any arbitrary asset and data<\/li>\n<li id=\"8e95\" class=\"mj mk iv kf b kg ms kk mt ko mu ks mv kw mw la mo mp mq mr fx\" data-selectable-paragraph=\"\">Bridging of NFTs<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">To learn more about <\/span>deBridge Finance<span style=\"font-weight: 400;\">, read <strong>the official documentation<\/strong><\/span><strong> <a href=\"https:\/\/docs.debridge.finance\/\">here<\/a><\/strong><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h4>About the audit<\/h4>\n<p>Ackee Blockchain<span style=\"font-weight: 400;\"> and<\/span> deBridge Finance<span style=\"font-weight: 400;\"> agreed to perform two follow-up audits. Between <strong>October 18 and October 29, 2021<\/strong>, the<\/span>\u00a0<a href=\"https:\/\/ackeeblockchain.com\/\">Ackee Blockchain<\/a> security team<span style=\"font-weight: 400;\"> successfully completed the <strong>first<\/strong><\/span><b> audit<\/b>. The time donation was 20 engineering days.<\/p>\n<p><b>The second audit<\/b><span style=\"font-weight: 400;\"> of deBridge Finance was performed between<strong> November 22 and December 3, 2021, <\/strong><\/span>with a time donation of 10 engineering days. Its main focus was checking whether<span class=\"Apple-converted-space\">\u00a0<\/span>reported issues from the first revision were correctly fixed.<\/p>\n<p>At the beginning of the\u00a0<a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/audit\/\"><span class=\"s1\">audit<\/span><\/a>, the\u00a0following\u00a0<b>main objectives\u00a0<\/b>were defined:<\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Check the overall code quality and best practices.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Check the functionality of the system.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Check if nobody unauthorized is able to claim or send assets.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">Check if the discovered issues were correctly fixed and the correctness of a newly implemented logic for the change balance and keys management.<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">Check if the refactored code didn\u2019t bring any new issues.<\/li>\n<\/ul>\n<p>The security review was performed by\u00a0<strong>m<\/strong><b>anual code review\u00a0<\/b>\u2013 checking the code line by line for common vulnerabilities or code duplication, and by\u00a0<strong>l<\/strong><b>ocal deployment and hacking<\/b>\u00a0\u2013 deploying the program locally, then trying to attack the system and break it.<\/p>\n<h4>Findings<\/h4>\n<div class=\"page\" title=\"Page 19\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p>Using the tools mentioned above led to <strong>the following\u00a0<a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/findings\/\">findings<\/a><\/strong>:<\/p>\n<ul>\n<li>L1: Typos in several places in the code<\/li>\n<li>L2: Bad naming conventions<\/li>\n<li>L3: NewTypes or type aliases for primitive types<\/li>\n<li>L4: Missing or Unused code<\/li>\n<li>L5: Unused accounts<\/li>\n<li>L6: Unconstrained <em>authority<\/em><\/li>\n<li>L7: Using of <em>ProgramAccount<\/em> struct<\/li>\n<li>L8: Add extra optimizations in <em>Cargo.toml<\/em><\/li>\n<li>L9: Use the latest stable Rust version (1.56)<\/li>\n<li>L10: Consider more pedantic <em>clippy<\/em> rules<\/li>\n<li>M1: Use <a href=\"https:\/\/docs.rs\/solana-program\/1.8.1\/solana_program\/pubkey\/struct.Pubkey.html#method.create_program_address\">create_program_address<\/a> instead of <a href=\"https:\/\/docs.rs\/solana-program\/1.8.1\/solana_program\/pubkey\/struct.Pubkey.html#method.find_program_address\">find_program_address<\/a><\/li>\n<li>M2: Using API calls instead of SysVar<\/li>\n<li>M3: Extra SEED during checking, constraint fails even the right account is used<\/li>\n<li>M4: Comparing bad PubKeys<\/li>\n<li>M5: Badly calculated rent exempt for one day<\/li>\n<li>M6: <em>BridgeCtx::staking_wallet<\/em> bad constraint<\/li>\n<li>H1: <em>InitSendBridge<\/em> computational Budget<\/li>\n<li>H2: Custom program errors in <em>settings<\/em> program<\/li>\n<li>H3: The program violates the stack size at runtime, an <em>AccessViolation error<\/em><\/li>\n<\/ul>\n<p><strong>10 low <\/strong>severity, <strong>6\u00a0medium<\/strong> severity, and<strong> 3 high<\/strong> severity issues were identified.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h5>Revision 2<\/h5>\n<ul>\n<li>L11: Mistakes in documentation<\/li>\n<li>L12: Ununified approach to system accounts constraint<\/li>\n<li>L13: Wrongly used range literal<\/li>\n<li>M1: Still several places where <a href=\"https:\/\/docs.rs\/solana-program\/1.8.1\/solana_program\/pubkey\/struct.Pubkey.html#method.create_program_address\">create_program_address<\/a> can be used instead of <a href=\"https:\/\/docs.rs\/solana-program\/1.8.1\/solana_program\/pubkey\/struct.Pubkey.html#method.find_program_address\">find_program_address<\/a><\/li>\n<li>H4: Protocol doesn\u2019t collected native fix fee<\/li>\n<\/ul>\n<div class=\"page\" title=\"Page 19\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p>Revision 2 of the audit discovered <strong>3 low <\/strong>severity, <strong>1 medium<\/strong> severity and <strong>1 high<\/strong> severity issues.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h4>Conclusion<\/h4>\n<div class=\"page\" title=\"Page 19\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p>The <strong>code is mature in quality<\/strong>, with sufficient test coverage and supporting documentation. The client <strong>correctly fixed all issues<\/strong> discovered in Revision 1 except issue M1, which was addressed correctly but not all of its occurrences.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p><strong>deBridge Finance values security as the most crucial aspect of cross-chain interoperability<\/strong><span style=\"font-weight: 400;\"><strong>.<\/strong> We also share these values at<\/span> Ackee Blockchain<span style=\"font-weight: 400;\"> and are honored to have been chosen as their audit partner.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><strong>The full <span style=\"font-weight: 400;\"><b>Ackee Blockchain audit<\/b> <b>report<\/b> <strong>of<\/strong><b> deBridge Finance with<\/b><\/span> a more detailed description of all findings and recommendations can be found <a href=\"https:\/\/github.com\/debridge-finance\/debridge-security\/blob\/master\/deBridge_Solana_Security_Audit_Ackee.pdf\">here<\/a>.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>About deBridge Finance deBridge is a cross-chain interoperability and liquidity transfer protocol that allows decentralized transfer of assets between various blockchains. The cross-chain intercommunication of deBridge smart contracts is powered by a network of independent oracles\/validators elected by deBridge governance.<\/p>\n","protected":false},"author":11,"featured_media":117,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,5],"tags":[21,6],"class_list":["post-112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-solana","tag-audit","tag-solana"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/02\/ABCH-deBridge-Finance-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/02\/ABCH-deBridge-Finance-600x600.png","author_info":{"display_name":"Andrea Nov\u00e1kov\u00e1","author_link":"https:\/\/ackee.xyz\/blog\/author\/andrea-novakova\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=112"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/112\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/117"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}